Software update device and software update method

Abstract

To perform better permission to update software and update of the software while meeting legal requirements.SOLUTION: A software update apparatus 100 includes a plurality of ECUs 200 that are mounted on a vehicle 10 and can update software, an acquisition unit that acquires software provided from an outside of the vehicle 10, and an update control unit 111 that updates the software of the plurality of ECUs 200 using the software acquired by the acquisition unit. The plurality of ECUs 200 includes a first ECU 200A including a single storage region that can install and update the software acquired by the acquisition unit, and a second ECU 200B including a double bank storage region that can install and update the software acquired by the acquisition unit in the background. The update control unit 111 notifies a notification of the update of the software of the first ECU 200A by voice just before the vehicle 10 stops.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a software updating device and a software updating method. [Background technology]

[0002] In recent years, advances in driver assistance functions and autonomous driving technology have led to an increase in the scale of software installed in automotive electronic control units (ECUs). At the same time, advances in communication networks have also shown signs of the spread of connected cars, in which automobiles are wirelessly connected to center systems. In light of these circumstances, there is a growing need for remote software update technology for automobiles that applies Over the Air (OTA) wireless software update technology previously used for mobile phones, televisions, etc., to automobiles, allowing software in on-board devices such as ECUs to be updated remotely.

[0003] Patent Document 1 describes an in-vehicle gateway device connected to multiple networks to which multiple devices mounted on a vehicle are respectively connected, the in-vehicle gateway device including an incident detection processing unit that detects an incident occurring in any of the multiple networks, and a communication control unit that, when the incident is detected, determines a network from among the multiple networks that is to be blocked based on the location of the incident and the control state of the vehicle, and blocks communication in the network that is to be blocked. The device described in Patent Document 1 is said to block unauthorized communication without adversely affecting vehicle control. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-133721 A Summary of the Invention [Problem to be solved by the invention]

[0005] In the vehicle stop control device of Patent Document 1, when there is an OTA update, the user consent screen for the software update can only be displayed for 2 seconds while driving due to legal requirements. For this reason, the user consent screen is only displayed while the vehicle is stopped. Even in cases where there is an OTA update, the timing of the driver's notification and consent is limited to when the vehicle is stopped, and the situation in which the software update can be performed is limited. It is not possible to realize a user-friendly OTA software update for in-vehicle devices.

[0006] The present invention has been made in consideration of the above circumstances, and has an objective of providing a software update device and a software update method that better permits software updates and updates software while satisfying legal requirements to keep the driver's eyes on the vehicle. [Means for solving the problem]

[0007] In order to solve the above problems, the software update device of the present invention is a software update device including a plurality of electronic control devices mounted on a vehicle and capable of updating software, an acquisition unit that acquires software supplied from outside the vehicle, and an update control unit that updates the software for the plurality of electronic control devices using the software acquired by the acquisition unit, the software update device including a first electronic control device having a single storage area in which the software acquired by the acquisition unit can be installed and updated, the update control unit having a storage means that stores candidate locations for stopping the vehicle where the software can be updated as specific locations in advance as designated by a user, and when the vehicle approaches the specific location stored in the storage means, notifies the user of information regarding the update of the software of the first electronic control device by voice. The plurality of electronic control devices include a second electronic control device having a double bank storage area capable of installing and updating the software acquired by the acquisition unit in the background, and the update control unit notifies information regarding the update of the software of the second electronic control device by using a voice or an image while the vehicle is stopped when updating the software of the second electronic control device, and the update control unit performs an installation process of new software in the double bank storage area of ​​the second electronic control device in the background, and replaces the new software installed in the background with the old software installed in the double bank storage area of ​​the second electronic control device by an activation process when an ignition switch is turned off, and the second electronic control device has a resume function for saving and stopping the execution state after the installation process of the new software in the double bank storage area and returning to the state immediately before the stop when used next, and the update control unit executes the new software replaced by the activation process when the ignition switch is turned on. It is characterized by: Effect of the Invention

[0008] The present invention provides improved software update authorization and updating while still satisfying regulatory requirements to keep the driver in line of sight. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram showing a configuration of a software updating system including a software updating device according to an embodiment of the present invention. [Diagram 2] 1 is a diagram showing an example of the configuration of an in-vehicle system including a software update device that supports OTA updates of the software update device according to an embodiment of the present invention. FIG. [Diagram 3] 1 is a diagram showing an example of the configuration of an in-vehicle system including a software update device that supports OTA update of the software update device according to an embodiment of the present invention. FIG. [Figure 4] 5 is a timing chart showing an example of a software update operation performed by the software update device according to the embodiment of the present invention. [Diagram 5] 5 is a timing chart showing an example of a software update operation performed by the software update device according to the embodiment of the present invention. [Figure 6] 4 is a flowchart showing an operation of the software updating device according to the embodiment of the present invention. [Figure 7] 1 is a diagram illustrating an operation image of a software updating device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. (Embodiment) FIG. 1 is a diagram showing a configuration of a software updating system including a software updating device according to an embodiment of the present invention. [Software Update System] The software update system 1 shown in Figure 1 includes a software update device 100 that manages software updates for various electronic control units (ECUs: Electronic Control Units) installed in a vehicle 10, and a server 40 that distributes update software for updating the software of the various ECUs installed in the vehicle 10 to the vehicle 10 via a network 30.

[0011] The server 40 and the software update device 100 are connected to each other via a network 30 and a communication unit 13 (acquisition unit) mounted on the vehicle 10. This connection enables communication between the server 40 and the software update device 100. Examples of the network 30 include a mobile phone network, an Internet network, a short-distance wireless communication such as a wireless LAN (Local Area Network), or a combination of a plurality of these.

[0012] The server 40 includes a CPU (Central Processing Unit) 41, a DB (Data Base) 42, and a communication unit 43. The server 40 is, for example, an OTA server that supports OTA and distributes update software for updating software of various ECUs of the vehicle 10 to the software update device 100 of the vehicle 10. The CPU 41 executes a predetermined operation program to perform processing to realize the functions of the server 40. The CPU 41 manages update cases that indicate the software update contents for each ECU of the vehicle 10, which are stored in the DB 42. The CPU 41 also distributes update software to the vehicle 10 in response to a request from the vehicle 10. If a software update for any of the ECUs mounted on the vehicle 10 fails, the CPU 41 distributes recovery software to the vehicle 10 to return the software of the ECU to the state before the update.

[0013] The DB 42 is composed of, for example, a hard disk drive (HDD), a solid state drive (SSD), a flash memory, a read only memory (ROM), etc. The DB 42 stores new software (update software) for updating software (old software, current software) installed in the electronic control device 200. The DB 42 also stores programs executed by the CPU 41, data groups required for executing the programs, etc.

[0014] The communication unit 43 is composed of a network card and the like that conforms to the communication standard used in the network 30. The network card conforms to the communication standard required for wired communication such as a wired LAN, wireless communication such as a wireless LAN, or both. The communication unit 43 transmits and receives data to and from the vehicle 10 via the network 30 based on various protocols.

[0015] [Software update device 100] The vehicle 10 on which the software update device 100 is mounted includes, for example, automobiles powered by internal combustion engines such as diesel engines and gasoline engines, electric automobiles powered by electric motors, hybrid automobiles that combine an internal combustion engine and an electric motor, etc. Electric automobiles are driven by electricity discharged from batteries such as secondary batteries, hydrogen fuel cells, metal fuel cells, and alcohol fuel cells.

[0016] The vehicle 10 includes a software update device 100, an ECU 200 (electronic control unit), an ignition switch (IGSW) 11, a battery (BAT) 12, a communication unit 13, a GPS (Global Positioning System) function unit 14 (location information acquisition unit), an information output / input device 20, and a voice recognition function unit 25 (location information acquisition unit).

[0017] The software updating device 100 includes a calculation unit 110 and a storage unit 120. The calculation unit 110 is responsible for the overall control of the software updating device 100. The calculation unit 110 executes software (firmware) update control by controlling each unit based on a program stored in the storage unit 120. The calculation unit 110 includes an update control unit 111. The storage unit 120 includes a volatile memory (not shown) and a non-volatile memory (not shown). New versions of software downloaded from the server 40 are temporarily stored in the storage unit 120.

[0018] <ecu200> The vehicle 10 includes a plurality of ECUs 200. In Fig. 1, three ECUs 200B, 200B, 200C, ... are shown among the plurality of ECUs 200. When describing ECUs in general, ECU 200 will be used, and when describing each ECU, ECUs 200B, 200B, 200C, ... will be used.

[0019] The multiple ECUs 200 are, for example, an engine ECU, an ABSECU, a steering ECU, a suspension ECU, an airbag ECU, an automatic driving ECU, a keyless entry ECU, an air conditioner control ECU, an audio ECU, and the like. The engine ECU manages the engine operation of the vehicle 10. The ABSECU manages the ABS (Antilock Brake System) of the vehicle 10. The steering ECU manages steering control of the vehicle 10. The suspension ECU manages suspension control of the vehicle 10. The airbag ECU manages operation control of the airbag of the vehicle 10. The automatic driving ECU manages operation control of automatic driving of the vehicle 10. The keyless entry ECU manages control of the keyless entry of the vehicle 10. The air conditioner control ECU controls the air conditioner of the vehicle 10. The audio ECU controls the operation of the audio equipment of the vehicle 10. Each equipment is connected by an in-vehicle network such as a CAN (Controller Area Network). Also, as shown in FIG. 1, each of the above ECUs is connected to a different bus-type CAN network according to its functional division. The software update device 100 has a hub function of these bus-type networks.

[0020] The software-updatable ECU 200 mounted on the vehicle 10 is not limited to the above. For example, the vehicle 10 may be equipped with an ECU having a function of supporting the control and safety of the vehicle 10, such as an ECU for brake control or an ECU for electronic mirror control. Each ECU has built-in software for operating itself. This software is stored in a storage device of each ECU.

[0021] When updating the software of an in-vehicle unit, it is necessary to keep the current software intact and not delete it in case the update fails. In particular, when downloading new software via wireless communication, there is a high possibility that the download will fail or that the installation of the new software will fail due to a data error. If this happens, the in-vehicle unit may not work at all because the current software has already been deleted. As a result, special repair work may be required. Furthermore, as the functions of vehicle-mounted devices become increasingly complex, the memory capacity required to store the software used in the vehicle-mounted devices also tends to increase, leading to an increase in the cost of the vehicle-mounted devices.

[0022] Therefore, among the multiple ECUs 200 mounted on the vehicle 10 and capable of updating software, a configuration is adopted in which a first ECU (first electronic control unit) is not provided with a double bank storage area, but has a single storage area in which software acquired by an acquisition unit can be installed and updated, and a second ECU (second electronic control unit) has a double bank storage area in which software acquired by an acquisition unit can be installed and updated in the background. By using the second ECU with a double bank storage area, both new and old software can be stored, and it is possible to prevent the in-vehicle device from becoming unusable due to a failure in updating the software. By using the first ECU with a single storage area, it is possible to suppress an increase in the cost of the storage device.

[0023] In the following, the first ECU, which does not have a double bank storage area and has a single storage area that can be updated by installing software acquired by an acquisition unit, will be referred to as ECU200A, and the second ECU, which has a double bank storage area that can be updated by installing software in the background, will be referred to as ECU200B. The first CU is ECU 200A, and the second ECU is ECU 200B for convenience of explanation, and any ECU may be used. Also, there may be a plurality of first ECUs and a plurality of ECUs. For example, ECU 200B (second ECU) may be an ECU for in-vehicle infotainment (IVI), an ECU for a meter display unit, or the like, and ECU 200A (first ECU) may be an audio ECU, or the like. The first ECU 200A having only a single storage area may be called a single-sided ROM ECU, and the second ECU having a double-bank storage area may be called a dual-sided ROM ECU.

[0024] As described above, the storage capacity of the non-volatile memory (not shown) provided in the second ECU 200B (two-sided ROM ECU) having a double bank storage area is relatively large, and multiple non-volatile memory chips are provided. When two non-volatile memory chips are provided, the first memory chip is mounted, for example, on one side of a substrate (not shown), and the second memory chip is mounted, for example, on the other side of the substrate. The first memory chip constitutes a first bank (first memory bank, first storage location). The second memory chip constitutes a second bank (second memory bank, second storage location). Such a configuration is called a double bank.

[0025] The capacity of the non-volatile memory (not shown) provided in the first ECU 200A (single-sided ROM ECU) is relatively small. The first ECU 200A is provided with, for example, only one non-volatile memory chip. A bank is configured by one memory chip. Such a configuration is called a single bank. In the first ECU 200A, when an old version of software is installed in a memory chip, a second new version of software cannot be installed in the memory chip.

[0026] The first ECU 200A does not have a storage area in which new software is installed in the background. Therefore, new software is not installed in the first ECU 200A while the vehicle 10 is running. Therefore, the update control unit 111 installs new software in the first ECU 200A when the vehicle 10 is stopped. In other words, the update control unit 111 installs new software in the first ECU 200A when the main power supply of the vehicle 10 is turned off, that is, when the ignition switch 11 is turned off. Even when the ignition switch 11 is turned off, power is supplied to the software update device 100, the communication unit 13, the ECU 200, etc. from the battery 12, etc. as appropriate.

[0027] On the other hand, in the second ECU 200B, for example, when the old version software is installed in the first bank, it is possible to install the new version software in the second bank. That is, the second bank functions as a buffer when installing the new version software. In other words, the second bank functions as a storage area (installable area) where the new version software is installed in the background.

[0028] As described above, the second ECU 200B is provided with a storage area in which new software is installed in the background. Therefore, new software can be downloaded and installed into the second ECU 200B even while the vehicle 10 is running.

[0029] <Update control unit 111> The calculation unit 110 of the software update device 100 includes an update control unit 111, which notifies the vehicle 10 of a software update of the first ECU 200A (information related to the software update) by voice when the vehicle 10 is about to stop. (1) Audio notification when the vehicle is about to stop in the first ECU 200A (single-sided ROM ECU) The "stopping" just before stopping refers to stopping at a location ("specific location") where the vehicle 10 is known to be stopped for a relatively long time, such as a home or workplace parking lot. This specific location refers to a location where it is known from experience that the user will stop for a long time, such as a home or workplace parking lot, as well as a parking lot at a shopping mall. A specific location is acquired when a home or workplace parking lot or a parking lot at a shopping mall is selected in the navigation settings. In addition, parking locations and their parking times may be stored in a table, and locations where long-term parking is common may be set as specific locations. This is because, when the vehicle is stopped at such a specific location, even if updating the ECU software in the first ECU 200A (single-sided ROM ECU) takes a relatively long time, it is expected that the software update will be completed while the vehicle is stopped.

[0030] In addition, the term "about to stop" refers to a case where the vehicle 10 is approaching a specific location based on location information acquired by the GPS function unit 14 (location information acquisition unit). Also, instead of or in addition to the location information acquisition unit, it may be determined that the vehicle 10 is approaching a specific location based on navigation information.

[0031] In this way, when the vehicle 10 approaches a specific location where it is highly likely that the vehicle will stop, the short time just before the vehicle stops is effectively utilized to notify the driver by voice of the software update. In the case of updating software for the first ECU 200A (single-sided ROM ECU), a relatively long update time is required. Rather than waiting until the vehicle 10 stops to inform the driver of the ECU software update, the software update notification can be given in advance by voice when the next schedule is known, using the time just before the vehicle stops, thereby realizing a driver-friendly software update.

[0032] In this embodiment, when the vehicle approaches a specific location where the vehicle will be stopped for a predetermined period of time, the update control unit 111 infers that the vehicle is about to stop based on the location information acquired by the location information acquisition unit, and notifies the vehicle of a software update for the first ECU 200A. When the vehicle 10 is about to come to a stop, a voice message may be given that reads, for example, "Do you want to update the ECU software after stopping? Software updates will incur communication fees and will take approximately xx minutes."

[0033] (2) Audio notification when the vehicle is stopped in the second ECU 200B (two-sided ROM ECU) When updating the software of the second ECU 200B, the update control unit 111 notifies the vehicle 10 of the update of the software of the second ECU 200B (information related to the software update) by using audio or images while the vehicle 10 is stopped. The stop of the vehicle 10 is a short stop where the vehicle 10 temporarily stops and then immediately starts moving again, such as when waiting at a traffic light. Here, a distinction is made between stopping the vehicle 10 and stopping the vehicle 10. That is, stopping the vehicle 10 refers to a short stop where the vehicle 10 temporarily stops and then immediately starts moving again, such as when waiting at a traffic light. In contrast, stopping the vehicle 10 refers to a relatively long stop where the vehicle 10 stops at home, in a parking lot, or the like, and does not move for a while.

[0034] In addition, when the vehicle is temporarily stopped at a traffic light, legal requirements are relaxed to permit messages to be displayed on the screen. The software update notification given while the vehicle 10 is stopped, such as at a traffic light, is a request for downloading by asking, "New software is available. Would you like to download it? A communication fee will be charged for updating the software." Downloading via OTA may incur communication fees. For this reason, it is necessary to ask the driver for approval of the software download. In this case, the "software update notification" only asks whether or not to download, so it takes only a short time and does not affect the operation of the vehicle 10. Furthermore, while the vehicle 10 is stopped, such as at a traffic light, the driver may view a screen, for example, by an HMI, for a certain period of time. Therefore, the software update notification is displayed on the screen. Note that audio and visual may be used together.

[0035] (3) Relationship between software update of first ECU 200A and software update of second ECU 200B When both the software update of the first ECU 200A and the software update of the second ECU 200B are performed after the vehicle 10 is stopped, the update control unit 111 notifies the vehicle 10 of the software update of the first ECU 200A just before the vehicle 10 is stopped. That is, the notification of the software update of the second ECU 200B requests permission to download, whereas the notification of the software update of the first ECU 200A is a notification of an important update informing the user that the in-vehicle device will not be able to operate for a predetermined time after the vehicle is stopped. Therefore, even if the software of the second ECU 200B is updated, the notification of the software update of the first ECU 200A (information about the software update) is notified.

[0036] (4) Receiving permission from the driver When the update control unit 111 notifies the driver of the software update of the second ECU 200B or the first ECU 200A, the update control unit 111 receives permission from the driver by the driver's voice or steering switch operation.

[0037] (5) Software update details The update control unit 111 performs the installation process of the new version software in the double bank storage area of ​​the second ECU 200B in the background, and when the ignition switch is turned off, it switches between the new version software installed in the background and the old version software installed in the double bank storage area of ​​the second ECU 200B through activation processing, making them executable. Here, activation refers to making it possible to execute a function provided in an ECU or the like when the ECU or the like is first started up or after initialization.

[0038] The second ECU 200B has a resume function that saves and stops the execution state of the new software after the installation process of the new software in the double bank storage area, and returns to the state immediately before the stop when the second ECU 200B is used next time. The update control unit 111 executes the new software switched by the activation process when the ignition switch is turned on.

[0039] Returning to Fig. 1, the communication unit 13 performs wireless communication with a communication unit 43 provided in a server 40 via a network 30. An example of the network 30 is the Internet, but is not limited to this. The communication unit 13 may be a communication unit that performs communication using a cellular system, or may be a communication unit that performs wireless LAN communication. The communication unit 13 receives new software provided from the server 40 via the network 30.

[0040] The GPS function unit 14 is equipped with a GPS antenna 14a that receives radio waves of location information from a GPS satellite (not shown), and acquires location information using a GPS function that calculates current location information as two parameters, latitude and longitude, from the information received via the GPS antenna 14a.

[0041] It should be noted that instead of or in combination with the GPS 14, it is also possible to transmit and receive information to and from a cellular server via a base station and a cellular communication network (not shown) and obtain the current position information of the vehicle from approach confirmation.

[0042] The information output / input device 20 includes a display unit 21, a touch panel 22, and a speaker 23. The main body of the information output / input device 20 is placed near the driver's seat to allow the driver to operate the touch panel 22, etc. The information output / input device 20 can display various types of information on the display unit 21, output various types of sounds from the speaker 23, and accept various operations via the touch panel 22.

[0043] The information output / input device 20 can display car navigation information created based on a satellite positioning system or the like on a touch panel 22, and can also output sound from a speaker 23. This information can include information received from a vehicle information and communication system (VICS).

[0044] The information output / input device 20 can receive TV broadcasts and radio broadcasts, display images on the display unit 21, and output audio from the speaker 23. The information output / input device 20 also includes an optical disk device (not shown) and can play CDs (Compact Discs), DVDs (Digital Video (Versatile) Disks), BDs (Blu-ray Discs), etc. The information output / input device 20 also includes an HDD (Hard Disk Drive) (not shown) and can also play audio such as music stored therein. The touch panel 22 can also receive various operations for the vehicle 100 and its on-board devices.

[0045] The voice recognition function unit 25 recognizes the voice of the user in the vehicle. The voice recognition function unit 25 is, for example, an AI (Artificial Intelligence) voice recognition device, and recognizes the user's voice using a voice profile (user's voice identification information created in advance) and provides corresponding functions such as traffic information and real-time information.

[0046] [In-vehicle system equipped with software update device 100] An in-vehicle system including the software updating device 100 will be described. 2 and 3 are diagrams showing an example of the configuration of an in-vehicle system including a software update device that supports OTA updates.

[0047] As shown in FIG. 2, the vehicle 10A includes an in-vehicle communication module (TCU: Telematics Control Unit) 130 (acquisition unit), a CGW (Central Gate Way) 140 constituting an OTA manager (OTA-MG), an in-vehicle information and communication system (IVI: In-Vehicle Infotainment) 150, a plurality of ECUs 200B, 200B, 200C, ..., and an LCD (Liquid Crystal Display) display unit 160 that provides the driver with an HMI (Human Machine Interface) by display or audio.

[0048] The TCU 130 corresponds to the communication unit 13 in FIG. 1, and performs 4G / 5G wireless communication with an OTA server 40 (hereinafter, the server 40 in FIG. 1 is referred to as the OTA server 40) via a network (not shown), and also performs short-distance wireless communication for remotely updating software by a mobile information terminal 45 such as a smartphone. The TCU 130 communicates with the OTA server 40 using OTA. The TCU 130 is connected to the CGW 140, and distributes update software for various ECUs 200 distributed from the OTA server to the CGW 140. Specifically, the TCU 130 transmits a control system OTA file 51 to the CGW 140, and transmits an information system OTA file 52 to the IVI 150 via the CGW 140. Note that a predetermined encryption method is used for communication between the TCU 130 and a network (not shown).

[0049] The CGW 140 and the IVI 150 constitute a software updating device 100A (corresponding to the software updating device 100 in FIG. 1). The CGW 140 controls the installation (described below). The CGW 140 controls rewriting of the ECU 200 based on a control system OTA file 51 and an information system OTA file 52 (described later). The CGW 140 performs activation control (described below). The CGW 140 transfers the information-related OTA file 52 to the IVI 150 (described later). The CGW 140 is connected via a wired connection to DLC (Downloadable Contents) (not shown) and can download the relevant content in accordance with, for example, diagnostic machine communication protocols and reprogramming protocols, and perform wired reprogramming (changing and adding to the ECU program) using a diagnostic machine.

[0050] The LCD display unit 160 corresponds to the information output / input device 20 (see FIG. 1) provided by the HMI. That is, the LCD display unit 160 shown in FIG. 2 includes a touch panel 22 (see FIG. 1) and a speaker 23 (see FIG. 1), and can display various information on the display unit 21 (see FIG. 1), output various sounds from the speaker 23, and accept various operations via the touch panel 22.

[0051] The IVI 150 controls rewriting of the IVI 150 based on the information-related OTA file 52 transferred from the CGW 140 (described later). The IVI 150 not only provides a human input function using buttons, switches, microphones, etc. on the information output / input device 20 (see FIG. 1), but also an automatic output function (for example, automatic seat adjustment, self-check of steering wheel and vehicle speed, etc.) by analyzing data collected by the in-vehicle camera and various sensors. The IVI 150 provides video-on-demand and other services based on the user's browsing history data obtained via Wi-Fi from a USB (Universal Serial Bus) memory 46, Bluetooth (registered trademark), or an access point (Wireless LAN access point) 47. A car navigation system equipped with the IVI 150 also provides more specific guidance.

[0052] 3, the vehicle 10B includes the TCU 130, the CGW 140, and a plurality of ECUs 200B, 200B, 200C, .... The vehicle 10B has a configuration obtained by removing the IVI 150 and the LCD display unit 160 from the vehicle 10A shown in FIG. The CGW 140 functions as the software update device 100B (corresponding to the software update device 100 in FIG. 1). Specifically, the CGW 140 performs installation control, and also performs rewriting control of the ECU 200 based on the control-related OTA file 51 and the information-related OTA file 52. Furthermore, the CGW 140 performs activation control.

[0053] In addition, the vehicle equipment (configuration examples of Figures 2 and 3) can be remotely updated using a smartphone 45.

[0054] The operation of the software updating device 100 configured as above will now be described. 4 and 5 are timing charts showing an example of the software updating operation by the software updating device 100. In FIG. <Operation of the first ECU 200A (single-sided ROM ECU)> FIG. 4 shows the operation timing of (a) vehicle power state (IG OFF / IG ON), (b) CAN bus state, (c) OTA MG (software update device 100 in FIG. 1, OTA manager 140 in FIG. 2 and FIG. 3), and (d) target ECU (first ECU 200A in FIG. 1) when the target ECU is a first ECU 200A (single-sided ROM ECU) having only a single storage area.

[0055] At timing t1 when the ignition switch 11 shown in FIG. 4(a) is off (IG OFF), i.e., when the vehicle 10 is stopped, the vehicle 10 switches the CAN bus state shown in FIG. 4(b) from "CAN normal control in progress" to "CAN transmission / reception stopped." The "CAN transmission / reception stopped" state continues until timing t6 when the ignition switch is next turned on (IG ON). In addition, the "re-IG ON prohibition control" continues until the completion of the OTA MG shown in FIG. 4(c) and the "activation process" shown in FIG. 4(d). By stopping CAN transmission / reception, it is possible to prevent unrelated units from starting up during the OTA update.

[0056] As shown by symbol a in Fig. 4(a), when the following OTA-only installation execution condition 1 is met at the timing t1 when the IG is turned off, the software installation process starts. The OTA-only installation execution condition 1 is, for example, that the vehicle speed is 0, P (parking) position is determined, the IG is turned off, and the hood switch is closed. By determining the OTA-only installation execution conditions, it is possible to support safety judgment on the vehicle side.

[0057] At timing t2 of the OTA MG shown in Figure 4(c) (a predetermined time has elapsed since timing t1 to prevent hunting), as shown by symbol b in Figure 4(a), the OTA MG (software update device 100 in Figure 1, OTA manager 140 in Figures 2 and 3) starts the installation process of the new version of the software in accordance with "OTA dedicated session 1".

[0058] At timing t3 of the OTA MG shown in FIG. 4(c), the installation process of the new software is completed and the activation process starts. As shown by symbol c in Fig. 4(c), the OTA MG issues a hardware reset request during the activation process of the new version of the software. By rebooting due to this hardware reset request, the target ECU recognizes (confirms) the installed new version of the software at timing t4 of the target ECU in Fig. 4(d).

[0059] At timing t5 of the OTA MG shown in FIG. 4(c), when the activation process of the new version of the software is normally completed, the OTA MG performs a shutdown process on the target ECU (the first ECU 200A in FIG. 1).

[0060] At the timing t6 when the IG is turned on as shown in Fig. 4(a), the vehicle 10 switches the CAN bus state as shown in Fig. 4(b) from "CAN transmission / reception stopped" to "CAN normal control in progress." Also, as shown in Fig. 4(c), the OTA MG returns to a state in which the next software update is possible. After timing t6 of the target ECU in FIG. 4(d), the target ECU (first ECU 200A in FIG. 1) operates based on the new version of the software.

[0061] <Operation of the second ECU 200B (two-sided ROM ECU)> FIG. 5 shows the operation timing of (a) vehicle power state (IG OFF / IG ON), (b) CAN bus state, (c) OTA MG (software update device 100 in FIG. 1, OTA manager 140 in FIG. 2 and FIG. 3), and (d) target ECU (second ECU 200B in FIG. 1) when the target ECU is second ECU 200B (dual-sided ROM ECU) having a double bank storage area that can install and update software in the background.

[0062] When the ignition switch 11 is on (IG ON), that is, when the vehicle 10 is running (Engine run), the TCU 130 (see FIG. 2) acquires software supplied from outside the vehicle 10 at timing t1 indicated by reference character d in FIG. 5(a). Specifically, the TCU 130 receives an update for the ECU software supplied from the OTA server 40, which is supplied from outside the vehicle 10. Note that since the vehicle 10 is running, that is, the IG is ON, the CAN bus state shown in FIG. 5(b) remains in "CAN normal control in progress." Therefore, all functions of the in-vehicle device are operating normally.

[0063] The ECU software update performed by the target ECU (second ECU 200B in FIG. 1), i.e., the ECU software update performed while the vehicle 10 is running, is performed when OTA-specific installation execution condition 2 is satisfied, which is different from the above-mentioned OTA-specific installation execution condition 1 when the vehicle 10 is stopped. The OTA MG executes the installation when the following OTA-specific installation execution condition 2 is satisfied. In other words, the conditions are that the IG is ON, the battery SOC is secured, the contactor is ON, and the battery does not run out.

[0064] As indicated by the symbol e in FIG. 5C, the OTA MG starts the installation process when it receives an update of the ECU software from the TCU 130 as a trigger. At timing t2 of OTA MG in FIG. 5(c), when the installation process is completed, OTA MG makes the target ECU (second ECU 200B in FIG. 1) wait using the resume function implemented in the target ECU (timing t3 in FIG. 5(c)). The resume function after the installation process is designed to allow the user to turn IG OFF during the installation process. This allows the process to be resumed from where it was in the middle after IG is turned ON.

[0065] At timing t4 when the ignition switch 11 shown in FIG. 5(a) is off (IG OFF), i.e., when the vehicle 10 is stopped, the vehicle 10 switches the CAN bus state shown in FIG. 5(b) from "CAN normal control in progress" to "CAN transmission / reception stopped." The "CAN transmission / reception stopped" state continues until timing t8 when the ignition switch is next turned on (IG ON). In addition, the "re-IG ON prohibition control" continues until the completion of the OTA MG shown in FIG. 5(c) and the "activation process" shown in FIG. 5(d). By stopping CAN transmission / reception, it is possible to prevent unrelated units from starting up during the OTA update.

[0066] As shown by symbol f in Fig. 5(a), when the OTA-only installation execution condition 1 is satisfied at the IG OFF timing t4, the installation is executed. The OTA-only installation execution condition 1 is the same as the OTA-only installation execution condition 1 executed by the second ECU 200A (single-sided ROM ECU) at the IG OFF timing t1.

[0067] At timing t5 of OTA MG shown in Fig. 5(c), as indicated by symbol g in Fig. 5(c), OTA MG (software update device 100 in Fig. 1, OTA manager 140 in Figs. 2 and 3) starts activation processing of the new version of software in accordance with "OTA dedicated session 2." Also, as indicated by symbol h in Fig. 5(c), OTA MG instructs the information output / input device 20 (see Fig. 1) and the LCD display unit 160 (see Fig. 2) to switch ROM sides.

[0068] At timing t5 of OTA MG shown in Fig. 5(c), activation processing of the new software is started. That is, while the vehicle 10 is running, the second ECU 200B (dual-sided ROM ECU) has already completed download and installation of the ECU software, and the software is held executable by the resume function. Therefore, when the IG OFF timing t4 is used as a trigger and "OTA-only session 2" is satisfied, only the activation processing of the new software is executed. While the vehicle 10 is stopped, only the activation processing is executed, so that the update of the ECU software can be completed quickly.

[0069] As shown by symbol i in Fig. 5(c), the OTA MG issues a hardware reset request during the activation process of the new version of the software. By rebooting the target ECU due to this hardware reset request, the target ECU switches the installed new version of the software at timing t6 of the target ECU in Fig. 5(d).

[0070] At timing t7 of the OTA MG shown in FIG. 5(c), when the activation process of the new version of the software is normally completed, the OTA MG performs a shutdown process on the target ECU (the first ECU 200A in FIG. 1).

[0071] At the timing t8 when the IG is turned on as shown in Fig. 5(a), the vehicle 10 switches the CAN bus state as shown in Fig. 5(b) from "CAN transmission / reception stopped" to "CAN normal control in progress." Also, as shown in Fig. 5(c), the OTA MG returns to a state in which the next software update is possible. After timing t6 of the target ECU in FIG. 5(d), the target ECU (first ECU 200A in FIG. 1) operates based on the new version of the software.

[0072] <Operation of the software update device 100> 6 is a flowchart showing the operation of the software updating device 100. This flow is repeatedly executed by the calculation unit 110 of the software updating device 100 at a predetermined timing. In step S1, the communication unit 13 (see FIG. 1) (TCU 130 in FIGS. 2 and 3) of the vehicle 10 determines whether or not it has acquired ECU update software from the OTA server 40 that is supplied from outside the vehicle 10. If it has not acquired ECU update software by OTA (S1: No), this flow ends.

[0073] If ECU update software is not acquired via OTA (S1: Yes), in step S2, the update control unit 111 of the calculation unit 110 determines whether the acquired ECU update software is intended for the first ECU 200A (single-sided ROM ECU) having only a single storage area, or for the second ECU 200B (dual-sided ROM ECU) having a double-bank storage area that can be installed and updated in the background.

[0074] If the updated software is for the first ECU 200A, in step S3, the update control unit 111 determines whether or not the vehicle 10 is about to stop. If the vehicle 10 is about to stop (S3: Yes), in step S4 the update control unit 111 notifies the user of the software update of the first ECU 200A by voice. When the vehicle 10 is about to stop, the message to be notified by voice is, for example, "Do you want to update the ECU software after stopping? A communication fee will be charged for the software update, and it will take about xx minutes."

[0075] In step S5, the update control unit 111 determines whether or not the driver has consented to the software update. The update control unit 111 receives the consent through the driver's voice or steering switch operation. If the driver permits the software update (S5: Yes), in step S6, the update control unit 111 determines whether the ignition switch 11 is off (IG OFF). If the IG is OFF (S6: Yes), in step S7, the update control unit 111 executes the software update in the first ECU 200A (single ROM ECU) and ends this flow. Thereafter, the first ECU 200A (single ROM ECU) operates based on the new version of the software. The software update in the first ECU 200A (single ROM ECU) has been described with reference to the timing chart of FIG. 4. If the driver does not permit the software update in step S5 above (S5: No), or if IG is ON in step S6 above (S6: No), this flow ends.

[0076] On the other hand, if the update software is the second ECU 200B in step S2, the update control unit 111 determines in step S8 whether the vehicle 10 is stopped while waiting for a traffic light or the like. The vehicle 10 is stopped, for example, when the output value of a wheel speed sensor (not shown) is 0.

[0077] As described above, a distinction is made between the stopping of the vehicle 10 and the stopping of the vehicle 10. That is, when updating software of the second ECU 200B having a double bank storage area, as described with reference to the timing chart of FIG. 5, the software of the ECU can be downloaded and installed in the background to the double bank storage area while the vehicle 10 is running. Therefore, while the vehicle 10 is running, the download and installation are already completed. Therefore, even if the vehicle 10 is stopped for a short time, such as while waiting at a traffic light, only the activation process is executed (see step S16 described later), and the update of the software of the ECU can be completed quickly.

[0078] If the vehicle 10 is stopped in step S8 (S8: Yes), the update control unit 111 notifies the driver of the software update of the first ECU 200A by voice or on a screen in step S9. The software update notification notified while the vehicle 10 is stopped at a traffic light or the like is a request to the driver to confirm whether or not to download the new version of the software. A communication fee may be charged for downloading by OTA. For this reason, it is necessary to ask the driver for approval of the software download. In this case, the "software update notification" only requests whether or not to download (the software is not downloaded at this point), so that it is completed in a short time and does not affect the operation of the vehicle 10. Furthermore, while the vehicle 10 is stopped at a traffic light or the like, the driver may view the screen, for example, by an HMI, for a certain period of time. Therefore, the software update notification is displayed on the screen. Note that both voice and screen may be used.

[0079] In step S10, the update control unit 111 determines whether or not the driver has consented to the software update. The update control unit 111 receives the consent from the driver through voice or steering switch operation. If the software update is permitted (S10: Yes), the process proceeds to step S11, and if the software update is not permitted (S10: No), the process skips step S11 and proceeds to step S12.

[0080] In step S11, the update control unit 111 downloads and installs the software in the background (see FIGS. 5(c) and 5(d)). In step S12, the update control unit 111 determines whether or not to simultaneously update the software of the first ECU 200A (single-sided ROM ECU) having only a single storage area. If the software of the first ECU 200A (single-sided ROM ECU) is to be updated at the same time (S12: Yes), the process proceeds to step S3. In other words, if the software of the first ECU 200A and the software of the second ECU 200B are to be updated at the same time, the process proceeds to step S3, whereby the notification of the software update of the first ECU 200A can be given again in step S3 just before the vehicle 10 is about to stop.

[0081] If the software of the first ECU 200A (single-sided ROM ECU) is not updated at the same time (S12: No), the update control unit 111 determines whether the ignition switch 11 is off (IG OFF) in step S13. If the IG is OFF (S13: Yes), the update control unit 111 performs activation processing in the second ECU 200B (two-sided ROM ECU) in step S14 (see FIG. 5(c)(d)). As described above, since the second ECU 200B (two-sided ROM ECU) has a double bank storage area, download and installation have already been completed in the background while the vehicle 10 is running. In addition, the software is held executable by the resume function. Therefore, the timing t4 of IG OFF is used as a trigger, and only the activation processing of the new version of the software is performed if the "OTA-only session 2" (see FIG. 5) is satisfied. If the IG is not OFF (S14: No), step S16 is skipped (activation processing is not performed) and the process proceeds to step S15. In step S15, the update control unit 111 determines whether the ignition switch 11 is on (IG ON). If the IG is on (S17: Yes), the update control unit 111 executes the new software in step S16 and ends this flow. If the IG is not on (S17: No), the update control unit 111 waits until the IG is on.

[0082] In addition, the internal processing of the software update device 100 is divided into software download, installation, and activation processing, and software download, installation, and activation processing, but from the user's perspective, all that is recognized is the length of time it takes to update the ECU software.

[0083] In this embodiment, by focusing on the difference in function between the second ECU 200B (two-sided ROM ECU) and the first ECU 200A (single-sided ROM ECU), optimal software update notifications are given while the vehicle 10 is running, when stopped at a traffic light or the like, when the vehicle is about to stop, and when the vehicle is stopped. In this case, by using voice, it is possible to more effectively approve and update the software update while satisfying the legal requirement to keep the driver's eyes on the vehicle.

[0084] <Operational Image of Software Update Device 100> FIG. 7 is a diagram for explaining an operational image of the software updating device 100. As shown in FIG. <step1> The vehicle 10 periodically communicates with the OTA server 40. During the ride, the vehicle 10 receives OTA updates from the OTA server 40. <step2> The vehicle 10 verifies the OTA data and downloads the ECU software. As shown by reference j in FIG. <step2>from <step4>This allows users to communicate with the driver via voice at any time, whether the vehicle is stopped or moving.

[0085] <step3> 7, while the ignition is on and the vehicle is stopped, the availability of software update is displayed. Also, a voice recognition function (Alexa, HPA, etc.) installed in the vehicle 10 is used. Alexa can use your voice profile to recognise your voice and customise what it can do for you. The driver allows installation. <step4> Displays the preparation. If the target ECU is a two-sided ROM ECU, installation is possible while driving. If the target ECU is a one-sided ROM ECU, installation is performed while the vehicle is stopped, and the waiting time is longer than for a two-sided ROM ECU.

[0086] <step5> Displays the software update status (updating software, progress of update, estimated time until update is complete, other notes, etc.) in the driver. <step6> Run the update and complete the software update. As shown in FIG. 7, <step5>and <step6>The ignition is off and the vehicle is stopped. <step7> Check the software update results when you turn the IG ON again (the next time you ride).

[0087] If the driver is near his / her home on the way home, it is easy for the driver to decide whether or not to use the vehicle 10 after this. Voice recognition is preferable because it allows instructions to be given at a timing when the driver's next action can be predicted. Specifically, it is effective in the following use cases. That is, (1) The timing of installing double bank can be permitted at any time. (2) For single bank, it is possible to determine in advance whether a safe location has been secured using GPS. This increases the timing of OTA updates, improving the adoption rate.

[0088] As described above, the software update device 100 (see FIG. 1) of the present embodiment includes a plurality of ECUs 200 (electronic control units) mounted on the vehicle 10 and capable of updating software, a communication unit 13 (see FIG. 1) and a TCU 130 (see FIGS. 2 and 3) (acquisition unit) that acquire software supplied from the outside of the vehicle 10, and an update control unit 111 (see FIG. 1) that updates the software for the plurality of ECUs 200 using the software acquired by the communication unit 13 and the TCU 130. The plurality of ECUs 200 include a first ECU 200A (single-sided ROM ECU) (see FIGS. 1 to 3 and 4) having a single storage area that can be updated by installing the software acquired by the communication unit 13 and the TCU 130. The update control unit 111 notifies the vehicle 10 of the software update of the first ECU 200A by voice when the vehicle 10 is about to stop.

[0089] With this configuration, when the next schedule is known, the driver can be asked by voice before stopping whether or not the vehicle will be immobilized for a while due to automatic software update. This makes it possible to better approve and update the software while satisfying the legal requirement that the driver must keep his or her eyes on the vehicle.

[0090] In this embodiment, the vehicle 10 (see FIG. 1) is equipped with a GPS function unit 14 (location information acquisition unit) (see FIG. 1) that acquires location information of the vehicle 10, and the update control unit 111 notifies the vehicle 10 of a software update for the first ECU 200A when the vehicle approaches a specific location where the vehicle will be stopped for a predetermined period of time based on the location information acquired by the GPS function unit 14.

[0091] This allows the driver to give permission to update the software and update the software more smoothly by notifying the driver when the driver approaches a specific location where the vehicle is usually parked for a long time, such as a parking lot at home or at work. In other words, when the driver gives permission to update the software, the software update is completed while the vehicle is parked for a long time and not being driven, which significantly improves convenience for the driver. In addition, when the software update is completed, the software update notification for this software is no longer sent, which has the advantage of eliminating the need to respond to frequent notifications.

[0092] In this embodiment, the vehicle 10 is provided with a second ECU 200B (two-sided ROM ECU) (see Figures 1 to 3 and 5) having a double bank storage area in which software acquired by the communication unit 13 and the TCU 130 can be installed and updated in the background, and when updating the software of the second ECU 200B, the update control unit 111 (see Figure 1) notifies the vehicle 10 of the update of the software of the second ECU 200B by using audio or images while the vehicle 10 is stopped.

[0093] This allows the software update notification to be sent using audio or images while the vehicle 10 is stopped, thereby making it possible to more effectively approve and update the software while still satisfying regulatory requirements. Also, when the target ECU is the second ECU 200B, the software can be downloaded and installed in the background, so that the impact on the operation of the vehicle 10 is short, and the OTA update timing can be increased.

[0094] In this embodiment, when both the software update of the first ECU 200A and the software update of the second ECU 200B are performed after the vehicle 10 is stopped, the update control unit 111 (see FIG. 1) notifies the vehicle 10 again of the software update of the first ECU 200A just before the vehicle 10 is stopped.

[0095] As a result, even if the software of the second ECU 200B is updated, the notification of the software update of the first ECU 200A is sent. By sending the notification of the software update again just before the vehicle 10 is stopped, the driver is notified again that the vehicle cannot move for a while due to the automatic software update, and this makes it possible to prevent the driver from missing the notification.

[0096] In this embodiment, when the update control unit 111 (see FIG. 1) notifies the driver of a software update of the second ECU 200B or the first ECU 200A, the update control unit 111 receives permission from the driver by the driver's voice or steering switch operation.

[0097] This allows the driver to receive permission for software update without disturbing the driver's attention to the road ahead, while keeping his or her gaze fixed on the road ahead.

[0098] In this embodiment, the update control unit 111 (see FIG. 1) performs an installation process of new software version in the double bank storage area of ​​the second ECU 200B in the background, and when the ignition switch is turned off, an activation process is performed to switch between the new software version installed in the background and the old software version installed in the double bank storage area of ​​the second ECU 200B, making them executable.

[0099] As a result, downloading and installation are already completed in the background while the vehicle 10 is running. When the ignition switch is off, that is, when the vehicle 10 is stopped, only the activation process is executed, so that the ECU software update can be completed quickly.

[0100] In this embodiment, the second ECU 200B has a resume function that saves and stops the execution state of the new software after installing it in the double bank storage area, and returns it to the state immediately before it was stopped the next time it is used, and the update control unit 111 executes the new software switched over by the activation process when the ignition switch is turned on.

[0101] This implements a resume function that allows the process to be resumed from where it was left off after the IG is turned ON again, so that even if the user turns the IG OFF during the installation process, the process can be quickly resumed from where it was left off, allowing for better software update approval and software updating.

[0102] The above-mentioned embodiment examples have been described in detail in order to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the configurations described above. [Explanation of symbols]

[0103] 1 Software Update System 10, 10A, 10B, 10C Vehicles 11 Ignition switch (IGSW) 12 Battery (BAT) 13. Communications Department (Acquisition Department) 14 GPS function section (location information acquisition section) 20 Information output / input device 25 Voice recognition function unit 30 Network 40 Servers 100 Software update device 130 TCU (Acquisition Department) 140 C.G.W. 150 IVI 160 LCD display section 200 ECU (Electronic Control Unit) 200A 1st ECU (1-sided ROM ECU) 200B Second ECU (2-sided ROM ECU)

Claims

1. A plurality of electronic control units mounted in a vehicle and capable of updating software; an acquisition unit that acquires software supplied from outside the vehicle; an update control unit that updates the software for a plurality of the electronic control units using the software acquired by the acquisition unit, a first electronic control device having a single storage area in which the software acquired by the acquisition unit can be installed and updated; The update control unit, a storage means for storing in advance, as a specific location, a candidate location for stopping the vehicle where the software can be updated, according to a user's designation; When the vehicle approaches the specific location stored in the storage means, notifying the driver of information regarding an update of the software of the first electronic control unit by using a voice; The plurality of electronic control devices include a second electronic control device having a double bank storage area capable of installing and updating the software acquired by the acquisition unit in the background, The update control unit notifies information regarding the update of the software of the second electronic control unit by using a voice or an image while the vehicle is stopped when updating the software of the second electronic control unit, the update control unit performs an installation process of the new version software in the double bank storage area of ​​the second electronic control unit in the background, and replaces the new version software installed in the background with the old version software installed in the double bank storage area of ​​the second electronic control unit by an activation process when an ignition switch is turned off; the second electronic control unit has a resume function for saving and stopping the execution state of the new software after the installation process of the new software in the double bank storage area, and for returning to the state immediately before the stop when the second electronic control unit is used next time; The update control unit executes the new version of the software replaced by the activation process when the ignition switch is turned on. A software updating device comprising:

2. A position information acquisition unit that acquires position information of a vehicle is provided, The update control unit notifies information regarding an update of the software of the first electronic control unit when the vehicle approaches a specific location where the vehicle is to be stopped for a predetermined time based on the location information acquired by the location information acquisition unit.

2. The software updating device according to claim 1.

3. When both the software update of the first electronic control unit and the software update of the second electronic control unit are performed after the vehicle is stopped, the update control unit notifies information regarding the software update of the first electronic control unit just before the vehicle is stopped.

2. The software updating device according to claim 1.

4. The update control unit receives consent from the driver through a voice or a steering switch operation of the driver when the driver is notified of information regarding the software update.

4. The software updating device according to claim 1, wherein the software updating device is a software updating device.

5. A plurality of electronic control units mounted in a vehicle and capable of updating software; an acquisition unit that acquires software supplied from outside the vehicle; an update control unit that updates the software for the plurality of electronic control units by using the software acquired by the acquisition unit; The plurality of electronic control devices include a first electronic control device having a single storage area in which the software acquired by the acquisition unit can be installed and updated, and a second electronic control device having a double bank storage area in which the software acquired by the acquisition unit can be installed and updated in the background, The update control unit includes a storage unit that stores candidate locations of a vehicle where the software can be updated as specific locations in advance, the candidate locations being designated by a user, the specific locations being a candidate location of a vehicle where the software can be updated. notifying, by voice, information regarding an update of the software of the first electronic control unit when the vehicle approaches the specific location stored in the storage means; When updating the software of the second electronic control unit, notifying the driver of information regarding the update of the software of the second electronic control unit by using a voice or an image while the vehicle is stopped; performing an installation process of the new version software in the double bank storage area of ​​the second electronic control unit in the background, and replacing the old version software installed in the double bank storage area of ​​the second electronic control unit with the new version software installed in the background by an activation process when an ignition switch is turned off; a step of executing a resume function for saving and stopping the execution state of the new software after the installation process of the new software in the double bank storage area, and for returning to the state immediately before the stop when the software is used next time; and executing the new version of the software replaced by the activation process when the ignition switch is turned on.

13. A software update method comprising:

Images